A computer network is a collection of interconnected computing devices that can exchange data and share resources. In a packet-based network, such as an Ethernet network, the computing devices communicate data by dividing the data into small blocks called packets, which are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.
The packets are communicated according to a communication protocol that defines the format of the packet. A typical packet, for example, includes a header carrying source and destination information, as well as a payload that carries the actual data. The de facto standard for communication in conventional packet-based networks, including the Internet, is the Transmission Control Protocol/Internet Protocol (TCP/IP).
A system administrator or other user often makes use of a network analyzer to monitor network traffic and debug network problems. In general, a network analyzer is a tool that captures data from a network and displays the data to the user. The network analyzer typically allows the user to browse the captured data, and view summary and detail information for each packet. Accordingly, the user can view the network traffic flowing between devices on the network. The information collected during traffic flow analysis may be used for network planning, traffic engineering, network monitoring, usage-based billing and the like. Many conventional network analyzers, such as NetFlow, NeTraMet and FlowScan, use software applications to collect traffic flow information.
The analyzers typically monitor and collect packets having routing information that matches criteria specified by the system administrator. For example, the system administrator may specify a source and destination Internet Protocol (IP) addresses, source and destination port numbers, protocol type, type of service (ToS) and input interface information. The analyzers typically collect packets matching the specified criteria, and construct flow analysis diagrams. Consequently, typical network analyzers only provide traffic flow statistics for the specified packet flows, and do not provide sufficient insight into traffic conditions across large networks. In addition, the network analyzers may make use of sampling techniques to selectively sample the packets, and present a statistically generated view of the traffic within the network. As a result, the statistics generated by the network analyzer may not only be limited to specified flows, but may be relatively inaccurate.